Older blog entries for mjg59 (starting at number 48)

QPL specifies Oslo

The copy in libcwd doesn't. Given that there's no permission granted to modify the license, that's a more obvious problem with the package than the license itself.

the desert island test is commonly also linked to DFSG 1 (as it costs to notify), 6 (because private study is often accepted as a field of endeavour), 7 (because we may be able to send to people who cannot send back)

We can happily construct a fringe case that would render the 4-clause BSD license to fail the same criteria. Bobby BSD-zealot obtains a nice new copy of Debian. He thinks it's so great he engraves an advert on a large sheet of metal that also happens to be covered in solar cells on the other side. The advert makes great claims about how wonderful Debian is (as it bloody well should do), and lists several of the features. One is how the included libdb1-compat package makes it easy to run obsolete applications on a current Debian system.

Poor old Bobby gets shipwrecked and ends up on a desert island. Thankfully his laptop washes up alongside him, along with a pile of blank CDs and his large metal advert/solar panel (obviously God is a Debian user). Overjoyed by this, Bobby is even happier to find that there are other people on the island, and they all have laptops too. Sadly, they're all running Windows. But thankfully Bobby can burn them copies of Debian and the world can be a better place.

Or can it?

Because the libdb1-compat package contains a copyright file that states:

3. All advertising materials mentioning features or use ofthis software must display the following acknowledgement:

This product includes software developed by Harvard University and its contributors.

Oh no! Bobby's advert doesn't display that acknowledgement. And, even worse, he doesn't have the tools to fix it (all the people washed up seem to have arrived with laptops, but nobody got a screwdriver. Poor Bobby). In order to comply with the license, Bobby must be able to fix his advert. But he can't. Ok, so he can destroy it instead. Except that his laptop will no longer have a power source, and he still won't be able to distribute Debian to all his new-found friends. The disappointment in the poor Windows users is so great that they rip Bobby apart and eat him. Ironically, the bone shards remaining afterwards would have sufficied to modify the advert. Bobby's death has made his software distributable.

Damn you 4-clause BSD license! Damn you!

Now, obviously, this is a stupid example. But should it be taken as meaning that the 4-clause BSD license is non-free, or should it be taken as meaning that the 4-clause BSD license is a silly license that we shouldn't recommend to anyone?

The GPL's 2c requirement that programs that emit copyright information when run interactively continue to do so discriminates against the blind, since they're actively forced to read (via braille) or listen to it, whereas those who can see can skip straight over it. I'd call that a fairly onerous restriction ("I have to listen to three lines of boilerplate every single time I want to look at a postscript file?")

If I end up on a desert island with a pile of GPLed binaries and the written offer for source I had has been eaten by sharks, how can I legitimately pass those binaries on? Stuck on a desert island, wanting to bring free software to the masses (well, one or two other survivors), and I can't. Bugger, eh? If a plane flies overhead and drops a note claiming that I'm infringing a patent and instructs me to stop redistributing at once, I can't engage in further distribution. Shame I can't actually fight the case because I'm stuck on a desert island, but still.

We can always find arguments about why individual licenses aren't free. The question is where the line gets drawn, and for the past few years that line has been moving. Should it be?

the FSF's four freedoms

Oh. Have we started listening to the FSF when it comes to freeness again?

there is no evidence given to favour debian-legal changing standards over debian-legal increased effort and increased capacity to investigate border cases instead of just leaving them to the "no consensus" catch-all.

Of course there is. A post to Debian-legal in 2000 says

In my opinion, the biggest conflict isn't 6c (though 6c could be a problem to someone doing a local distribution in a "third-world" country).

So 6c had been analysed back then. The issue was understood. But this didn't result in claims that the QPL was non-free, despite the fact that we were already shipping it in main. At time A, we appear to have decided that it didn't matter. At time B, we appear to have decided that it did matter. How is this not a change in standards?

I should really make it clear that I don't necessarily think that a change in standards is a bad thing. What I think needs answering is whether there's any sort of consensus on whether these tighter standards are a good thing.

Fun time at GUADEC, culminating in the advisory board meeting and a rather nice lunch. Arrived with a bottle of whisky, left it empty and sitting on a table about halfway through. Handy tip for conference attendees in Norway - bring a bottle of duty free and use it to buy friends and influence people.

My report of the stuff that's relevant to Debian is here, but I thought I'd add some commentary.

To a first approximation, we suck.

We're alienating ourselves from our users by taking so long to release, and we're alienating ourselves from our developers and the community at large by holding software to a higher standard of freedom than any other body on the planet. These two problems aren't desperately related, but they're both fundamentally tied to the fact that whoever shouts loudest and longest in an argument still tends to win, because most of our developer body is still concerned with development. Which means that it's the extremists who tend to win unless the matter is actually taken to a vote, at which point we tend to discover that the developer body is actually fairly moderate.

The release cycle argument tends to be made through repeated assertion - people often claim that our slow release cycle is what wins us friends in the corporate world (Netcraft had a story on Debian being the fastest growing Linux distribution a few months ago. Despite our last release already being 18 months old at that point), which I generally interpret as meaning that we might as well give up on anything that makes us superior in any technical respect because people will use us anyway. I'm more inclined to think that long-term support is more of an issue, and on paper we really don't deal too well with that at the moment (we're saved by virtue of the fact that we release so rarely...). Fixing that so we can support a distribution for ~2 years even if we've released another one in the intervening period is hard, but not impossible. We ought to start thinking about what would need doing and then work out how practical it is rather than pretend that it's never going to happen.

The legal situation is more fun. Looking at the past 3 GRs, we can see that:

• Developers want to keep non-free
• Developers want the DFSG to apply to everything in Debian...
• ...but they would rather release Sarge than delay it until that's been achieved

Which, to me, suggests that the set of the developers who care enough to get involved think that a DFSG-free distribution is a good thing (so we're not mostly made up of warez-bunnies) but that releasing a distribution is also a good thing (so we're not mostly made up of DFSG-extremists).

So, why is there so much of an issue with debian-legal at the moment?

As an example, let's take the QPL. The QPL contains a couple of problems. 6c requires that you provide patches back upstream if somebody asks for them, and the license states that disputes shall be settled in Amsterdam City Court. 6c is a problem if you receive a request from upstream but get shipwrecked on a desert island before you get to carry this out - arguably this would break DFSG 5 ("No discrimination against persons or groups") because we'd be discriminating against people who've been shipwrecked. Requiring people settle disputes in Amsterdam also discriminates against those who can't be represented there (lack of money, for instance).

So, problems.

But is this what we meant?

The QPL was previously declared free, not so much because we didn't read the license properly, but because our standards have changed. Or, at least, debian-legal's standards have changed and they're currently the closest think we have to an arbiter of freeness (strictly speaking it's ftp-masters' problem, but still). This hasn't caused a great deal of discussion elsewhere, mostly because every time someone tries to bring it up they rapidly lose the will to live after being hit with a barrage of "Chinese dissident" stuff. debian-legal contains rather a large number of people who are willing to argue, which is sort of the point, but if developers as a body disagree with the standards currently being used then they're going to have to make a stand at some point.

Which is, really, the point I'm trying to make. Lots of people disagree with various things about Debian, but nobody's taking a stand at the moment. I know what my standards of freedom are, and I know what my opinions regarding releases are. The problem is that I don't know how many other people feel the same way. I have suspicions, but I have no idea how accurate they are. Do debian-legal represent the mainstream opinion? Do we think that releases should be more frequent? Should we ignore the mainstream opinion and do the "right" thing anyway?

Buggered if I know.

Mono is potentially awkward because chunks of it are potentially under a bunch of patents that nobody will actually point at and which are owned by a company that wants us dead. Java is almost certainly awkward because chunks of it are potentially under a bunch of patents that are owned by a company that behaves in a massively schizophrenic manner towards us and would probably be reasonably happy if we fell off a cliff or something as long as our code didn't vanish. Oh, and we don't actually have a free compiler that implements all of the standard language functionality or some such madness and we can't actually call it Java unless we agree to let Sun molest our cat whenever they want to. And Python is, well, Python.

Now. Here is a question. I want you to think carefully about it. The answer is written on the line below the question. Do not read it until you've decided on your own answer. Cheating will lead to loss of marks and may result in pointing and laughing.

Question: Is the appropriate response to this situation to accuse each other of being worse than child molesting Nazi terrorists?

Answer: No. No, it isn't. GET A FUCKING GRIP, PEOPLE.

The only driver I've actually checked this in is the Orinoco one, but it reports link status by printk()ing something. This is fairly useless. I can't see any reason for the drivers /not/ to report this kind of thing in a useful way, and it'd certainly be nice to have userspace be able to do DHCP when I move within range of an access point rather than when I bring the interface up. You could probably hack something by looking at signal strengths, but it doesn't sound ideal.

In further news, I successfully hacked the BIOS of my X40 and now have a working wireless card. http://www.srcf.ucam.org/~mjg59/thinkpad/bios.html has some details.

I've written a page providing all information I have regarding the Thinkpad wireless card situation. Further information (compatibility with other models, for instance) would be helpful.

So, it was pointed out that DBus is under a dual AFL/GPL license. The GPL is a fine and upstanding license and I wholeheartedly endorse it, but it's not ideal for infrastructure if your worldview includes non-Free software. So that leaves the AFL ("Academic Free License") for people writing non-Free stuff that sits on top of your desktop environment. The AFL is an interesting license - it's written in terse legalese in order to make anyone trying to read it unhappy, but it's fundamentally straightforward:

• You can distribute the original code and derived works based upon it
• It gives you a patent license to any patents the author holds that relate to the code
• You must make available the source code of the unmodified code if you distribute the unmodified code. Unless I'm misreading it, there's no requirement to distribute source of derivative works
• Blah blah standard endorsement crap blah blah
• The fits signs of crack appear when it starts telling you that any descriptive text in the source marked as an "Attribution Notice" must be unmodified. This is just plain buggy - there's no definition of descriptive text, so if there's a function that does printf("Attribution Notice: The authors of this software believe that %s are inferior beings\n",ethnic_minority) then you may be unable to remove that from the source even though you can comment it out. Poorly defined invarient sections are bad.
• Blah blah NO WARRANTY blah blah
• Blah blah NO LIABILITY blah blah
• Blah blah YOU'RE ONLY ALLOWED TO MAKE DERIVATIVE WORKS IF YOU ACCEPT THIS LICENSE blah blah
• And then, after three paragraphs of BLAH, you get to the point where it says:

  10) Termination for Patent Action. This License shall
  terminate automatically and You may no longer exercise any 
  of the rights granted to You by this License as of the date 
  You commence an action, including a cross-claim or 
  counterclaim, for patent infringement (i) against Licensor 
  with respect to a patent applicable to software or (ii) 
  against any entity with respect to a patent applicable to 
  the Original Work (but excluding combinations of the 
  Original Work with other software or hardware).
  

  What this means is that if I, as a company holding any software patents, sue someone who holds copyright over any part of the code over any software patent whatsoever then I lose the right to use that software. Even if they've sued me over a software patent first. Even if what I'm suing them over has nothing to do with this software. This is plainly nuts. My right to utilise a piece of software is dependent on me not doing things that have nothing whatsoever to do with the software in question.
• Blah blah bunch of tedious stuff of little value

It's a bad license. It's a non-Free license. And it's OSI certified. The Open Source Insitute's definition of an Open Source license is heavily derived from the Debian DFSG, but somehow has been subverted in such a way that a large set of licenses that would be considered non-Free are OSI certified. Please don't encourage them.

Terrifying quantities of hot gnome-volume-manager and translucency action.

Oh, and b33r.

NET_WM_STRUT, where have you been all my life?

Off to Brussels tomorrow. Things to do:

1. Force people to make gnome-volume-manager work for me
2. B33r
3. Force people to make my sub-pixel anti-aliasing stop sucking at 6 points again
4. B33r
5. Uh...
6. B33r
7. Oh, yes, there's a conference, isn't there?
8. B33r